Archive for October 9, 2025

« Older Entries

AI Browsers Vulnerable to OAuth Attacks, Malware and Malicious Link Distribution

Posted in Commentary with tags on October 9, 2025 by itnerd

Researchers have uncovered major vulnerabilities that could allow attackers to exploit AI Browsers to exfiltrate sensitive data, distribute malware and gain unauthorized access to enterprise SaaS apps  —significant news as OpenAI, Microsoft, Google and The Browser Company have announced or released their own AI browsers. Chrome and Edge alone represent 70% of the browser market share. 

You can read more details here: https://www.prnewswire.com/news-releases/squarex-shows-ai-browsers-fall-prey-to-oauth-attacks-malware-downloads-and-malicious-link-distribution-302578487.html

Davit Asatryan, VP of Research at Spin.AI, provided the following comments:

“One key to preventing browser compromise is proactively blocking OAuth and extension-based attacks, where users are misled into installing third-party tools that seem legitimate but contain exploitable gaps or malicious intent. Consistent monitoring and governed approval of third-party apps and extensions is essential, enabling IT and security teams to assess risk before deployment.”

This is the second major threat to browsers that I am covering today. The first being this one. Thus proving that you need to be really careful when you surf the Internet as the bad guys are everywhere.

Leave a comment »

Attackers Actively Exploiting Critical Vulnerability in Service Finder Bookings Plugin- Expert Perspectives

Posted in Commentary with tags on October 9, 2025 by itnerd

Threat actors are actively exploiting a critical authentication bypass vulnerability (CVE-2025-5947, CVSS 9.8) in the Service Finder WordPress theme and its bundled Service Finder Bookings plugin. The flaw allows unauthenticated attackers to gain access to any account, including administrators, by exploiting improper cookie validation in the account-switching function. Attackers can hijack sites to inject malicious code, redirect users, or host malware. The issue affects all versions up to 6.0 and was patched in version 6.1 on July 17, 2025. Exploitation has been observed since August 1, with over 13,800 attempts detected to date.

Gunter Ollmann, CTO, Cobalt:

     “The pure deja vu of another critical WordPress vulnerability cannot be ignored. Threat actors are increasingly automating the exploitation of common CMS plugins to gain persistent access to web infrastructure. Once inside, adversaries can pivot to distributing malware, stealing credentials, or using compromised sites in larger botnets. The WordPress ecosystem’s accessibility makes it a prime target, and with so many vulnerabilities like this over the years for WordPress, security teams should treat the service as untrusted and strengthen systems around it to protect critical data and connected systems.”

I’m a WordPress user so any report of a vulnerability in this platform concerns me. If you’re running a self hosted instance of WordPress, you might want to make sure that you’re fully up to date as soon as you can.

Leave a comment »

New Shuyal Infostealer Steals Credentials from 19 Web Browsers

Posted in Commentary with tags on October 9, 2025 by itnerd

Researchers have discovered a new infostealer dubbed Shuyal Stealer, a browser-targeted malware strain that steals login credentials from 19 different web browsers, widening its scope beyond popular platforms like Chrome and Edge. It also takes a more invasive approach by conducting deep system reconnaissance collecting granular details about disk drives, input peripherals, and display setups while capturing screenshots and clipboard contents. All of this, including Discord tokens, is funneled out through a Telegram bot infrastructure, making Shuyal a highly efficient and stealthy data-exfiltration tool.

More details can be found here: https://www.pointwild.com/threat-intelligence/shuyal-stealer-advanced-infostealer-targeting-19-browsers

Davit Asatryan, VP of Research at Spin.AI, provided the following comments:

“We’ve seen a major increase in browser-level risks recently, indicating an emerging trend. It makes an attractive threat vector because it’s often an afterthought for security teams. It’s essential to keep an eye on this, as it’s only a matter of time before these attacks start cascading into serious SaaS compromises.”

If you’re concerned about a plug in or something similar sneaking its way onto your browser, this article can help you to stay safe: Uninstall or Disable Plugins to Make Your Browser More Secure

1 Comment »

Starburst Unveils AI-Ready Data Platform to Power the Agentic Workforce

Posted in Commentary with tags on October 9, 2025 by itnerd

 Starburst today announced at AI & Datanova, a new set of capabilities designed to operationalize the Agentic Workforce—a paradigm where humans and AI agents collaborate seamlessly across workflows to reason, decide, and act faster and with confidence. With new, built-in support for model-to-data architectures, multi-agent interoperability, and an open vector store on Iceberg, Starburst delivers the first lakehouse platform that empowers AI agents, with unified enterprise data, governed data products, and metadata, empowering humans and AI to reason, act, and decide faster while ensuring trust and control.

Unlike legacy platforms that require data movement or rely on black-box retrieval, Starburst gives AI agents secure, governed access to data wherever it resides, on-premises or in the cloud, at enterprise scale. This federated, model-to-data approach helps organizations maintain sovereignty, reduce costs, and avoid compliance pitfalls, especially in highly regulated industries or cross-border environments.

To further strengthen enterprise confidence in AI, Starburst is introducing advanced observability and visualization features for its agent framework. Organizations can now monitor usage of LLM interactions, set guardrails with usage limits, and view activity through intuitive dashboards. In addition, Starburst’s agent can visualize responses into charts and graphs giving teams not only accurate answers but also clear, actionable insights. These capabilities provide a new level of transparency, governance, and usability as enterprises scale AI adoption.

Key Innovations Driving the Next Generation of AI and Analytics

Starburst’s new AI capabilities are built upon the core principle of flexibility, giving organizations the freedom to choose between model-to-data and data-to-model architectures. This approach enables enterprises to scale AI securely, while preserving sovereignty, reducing infrastructure costs, and ensuring compliance. These enhancements include:

●      Multi-Agent Ready Infrastructure: A new MCP server and agent API allows enterprises to create, manage, and orchestrate multiple AI agents along-side the Starburst agent. This enables customers to develop multi-agent and AI application solutions that are geared to complete tasks of growing complexity.

●      Open & Interoperable Vector Access: Starburst unifies access to vector stores, enabling retrieval augmented generation (RAG) and search tasks across Iceberg, PostgreSQL + PGVector, Elasticsearch and more. Enterprises gain flexibility to choose the right vector solution for each workload without lock-in or fragmentation.

●      Model Usage Monitoring & Control: Starburst offers enterprise-grade AI model monitoring and governance. Teams can track, audit, and control AI usage across agents and workloads with dashboards, preventing cost overruns and ensuring compliance for confident, scalable AI adoption.

●      Deeper Insights & Visualization: An extension of Starburst’s conversational analytics agent enables users to ask questions across different data product domains and provide back a natural language response in natural language, a visualization, or combination of the two. The agent is able to understand the user intent and question to do data discovery to find the right data before query processing to answer the question.

Beyond Dashboards and Copilots: The Next Era of AI

AI is rapidly moving past dashboards and copilots toward autonomous workflows that demand both real-time decisioning and long-term context. For enterprises in regulated sectors, including finance, telecom, manufacturing, and public services, this shift raises a critical challenge: how to harness AI’s potential without compromising on data sovereignty,governance,  or compliance.

Starburst’s Platform: Built for Global-Scale, Compliance-First AI

Building on its core capabilities, Starburst enables enterprises operating across the EU and other regulated regions to deploy AI without breaching data residency, privacy, or compliance mandates. The platform provides federated access to distributed data, allowing organizations to query and analyze information in place without unnecessary movement.

By design, Starburst ensures data sovereignty across borders, clouds, and business units, while metadata-driven policy enforcement supports GDPR, Schrems II, and other evolving global regulations. With governance embedded at every layer, enterprises gain the confidence to scale AI securely and compliantly, no matter where their data lives.

Availability

New innovations in the Starburst Data Platform will be generally available in Q4.

Leave a comment »

Arcitecta Appoints Robert Mollard Global Business Development Lead

Posted in Commentary with tags on October 9, 2025 by itnerd

 Arcitecta, a creative and innovative data management software company, today announced the appointment of Robert Mollard as Global Business Development Lead. Mollard will leverage his extensive data management and workflow expertise to expand Arcitecta’s growth and delivery of its Mediaflux high-performance, secure and scalable data-driven solutions.

Mollard is an accomplished data management technologist and HPC and AI solutions architect with more than 20 years of experience helping customers solve data workflow requirements and complex challenges surrounding accessing, managing and optimizing data throughout its lifecycle. Before joining Arcitecta, Mollard worked for Hewlett Packard Enterprise (HPE) for nine years, serving as an HPC and AI solution architect and storage specialist covering the Asia Pacific region. He joined HPE from SGI, where he had served as a storage specialist for three years. Prior to SGI, he served as the primary systems design engineer for Australia/New Zealand at Data Direct Networks (DDN), where he designed high-performance parallel file system solutions for HPC centers. Mollard started his career with the CSIRO and iVEC (Pawsey) Supercomputing Centre, designed and managed Petascale high-performance data systems and storage initiatives.

Throughout his career, Mollard’s understanding of the end-to-end data path and data-intensive storage solutions has delivered significant outcomes to scientists, researchers and enterprise organizations, enabling them to focus on their work of accelerating results and discoveries, rather than the movement and management of data.

Leave a comment »

Enhance the gaming experience with specialized TV features designed for video games

Posted in Commentary with tags on October 9, 2025 by itnerd

As graphics and gameplay continue to become more true-to-life, having a television that can keep pace with what today’s video games offer is imperative.

With the growing popularity of gaming — according to a report by the Entertainment Software Association of Canada, more than half of Canadians play video games regularly — and rapid innovations in technology and design, it is no longer enough to simply plug a console into the TV and start playing.

Puneet Jain, Senior Director of Marketing and Ecommerce with Hisense Canada offers the following advice on the features to look for when shopping for the ultimate video game TV:

  • Refresh Rate — The faster the rate, the better the image will look on the screen. A variable refresh rate between 48Hz and 144Hz is ideal, reducing screen lag and supporting smooth visuals in motion. The higher the refresh rate, the better.
  • Low Latency MEMC — Motion Estimation, Motion Compensation (MEMC) technology seamlessly inserts frames for smoother motion and heightened visual clarity. This reduces input lag and motion blur, immersing the gamer in the gaming world.
  • AI Upscaling — Unlike traditional upscaling, AI upscaling computes neighbouring pixel colours to restore lost details and reduce image noise.
  • Synchronization — A feature like AMD FreeSync eliminates screen tearing and stuttering by aligning the TV’s refresh rate to match the frame rate of the gaming console. The result is a smoother, more fluid gaming experience with virtually no controller input lag.
  • Gaming Enhancements — Among the latest gaming innovations for TVs is the intuitive Game bar, which provides real-time information on the TV’s optimal settings for gaming, including a frame rate counter, Variable Refresh Rate status and input lag meter.
  • Big Screen — The Hisense PX3-PRO Trichroma laser cinema projector is designed specifically for Xbox, with a sharp 4K image on screen up to a massive 150 inches. It also boasts a refresh rate up to HSR 240, and a feature that automatically detects when your console is on and adjusts the projector settings to create seamless, lag-free gameplay.
  • Big Sound — Just like watching your favourite movie, the soundtrack and audio elements of a game complement the visuals. Look for multi-channel surround sound systems, combined with Dolby Atmos and AI Sound to deliver an immersive audio experience capturing everything from the quietest whispers to the most explosive scenes.

Hisense offers several televisions that package these technologies into its Game Mode feature, creating a dynamic gaming experience. Additional gaming features include “Gaming in Dolby” to provide deeper details and ultra-vivid colours with Dolby Vision, supported by Dolby Atmos enhancing dialogues, background noise and soundtracks.

The all-new QD5N, now available in Canada, is the latest addition to Hisense’s ultra-big screen family, featuring vivid colours and immersive audio for the ultimate gamer-ready performance. Equipped with Game Mode PRO, it offers a 144Hz refresh rate, Low Latency MEMC, VRR (48-44Hz), AMD FreeSync™ Premium, Auto Low Latency Mode and Hisense’s proprietary Game Bar for an ultra-responsive, super smooth and crystal clear gaming performance — there is virtually no screen tearing or output lag.

For more information, please visit hisense-canada.com. 

Leave a comment »

Outpost24 Appoints Martin Roth as Chief Technology Officer to Advance Global Engineering and Innovation

Posted in Commentary with tags on October 9, 2025 by itnerd

Outpost24 today announced the appointment of Martin Roth as Chief Technology Officer (CTO). Martin brings over 25 years of experience in software development, with a proven record of building and transforming technology organizations. His background combines deep technical expertise in product innovation and enterprise solution delivery with the ability to lead large, distributed teams in complex, security-sensitive environments. 

Before joining Outpost24, Martin held pivotal leadership roles at groundbreaking companies, such as Learnster, Viaplay, and Snow Software (now part of Flexera). In these roles, he was instrumental in scaling global Research & Development organizations through periods of rapid growth, establishing modern engineering and DevOps practices, and driving initiatives that dramatically strengthened delivery, innovation, and security across large enterprise software platforms.

At Outpost24, Martin will lead the company’s global engineering and technology strategy, shaping architecture, delivery, and development practices to drive agility and performance. Under his leadership, the company will accelerate its transition to cloud-native technologies, focusing on AI-driven solutions that will help its customers improve operational efficiency and their cybersecurity posture. He will drive a unified technical vision to enhance the delivery of the full-stack security platform—spanning continuous threat exposure management (CTEM), digital risk protection, cyber threat intelligence, and compliance—by building scalable systems and empowered teams that enable the company to innovate quickly and securely.

The appointment comes at a critical time for the cybersecurity industry, where proactive defence and a shift-left security approach are paramount. As threats become more sophisticated and regulatory pressures intensify, Outpost24 recognizes that world-class engineering is the foundation for delivering trusted, scalable security solutions. Martin’s expertise in building robust, high-availability enterprise platforms will be immediately leveraged to meet these escalating market demands.

Martin’s appointment follows recent additions to Outpost24’s leadership team, including a new Chief Information Security Officer (CISO) and Chief Corporate Development Officer (CCDO) — reinforcing the company’s commitment to innovation, technical excellence, and global expansion.

With a strong European presence and thousands of customers worldwide, Outpost24 continues to build the technological backbone for modern Exposure Management and Continuous Threat Exposure Management (CTEM), helping organizations proactively identify, prioritize, and remediate cyber risks across both digital and human attack surfaces.

Leave a comment »

Invoicely Data Breach Exposes PII and Payment Information

Posted in Commentary with tags on October 9, 2025 by itnerd

Website Planet has just published a report about a significant data breach involving Invoicely, a global billing and accounting platform.

What happened:

Cybersecurity researcher Jeremiah Fowler discovered a non-password-protected database containing nearly 180k records in XLSX, CSV, PDF, and various image formats. The exposed files included personally identifiable information (PII) such as names, physical addresses, phone numbers, tax ID numbers, and other sensitive details from service providers, partners, employees, and customers around the world.

Why it matters:

The exposure of names, email addresses, physical addresses, phone numbers, tax IDs, and financial account information presents a serious risk. This type of data can be exploited by cybercriminals for identity theft, financial fraud, spear-phishing, and social engineering attacks, among other threats.

You can read the full report here: https://www.websiteplanet.com/news/invoicely-breach-report/

Leave a comment »

Discord Pwned And Personally Identifiable Info Is In The Wrong Hands

Posted in Commentary with tags on October 9, 2025 by itnerd

There is news that the official ID photos of around 70 thousand Discord users have potentially been leaked after a cyber-attack. This concerns me personally as I use the app with my online cycling team.

Darren James, a Senior Product Manager at Specops Software said this:

“Identity verification has become a key component in both Know Your Customer (KYC) and Know Your Employee (KYE) scenarios. These requirements stem from recent legislation mandating that service providers make reasonable efforts to validate that their users are who they claim to be.”

“However, as we’ve seen in this case, if you are subject to these regulations—or even in the process of choosing a solution—you need to ensure that personally identifiable information (PII) is handled, processed, and stored securely, or ideally not stored at all unless required.”

“The high levels of identity assurance demanded in this age of AI-enhanced deepfakes will continue to grow. Businesses and consumers alike must understand the implications of these identity challenges, and vendors will need to implement appropriate safeguards to protect their customers’ privacy as well as their own reputations.”

Chris Hauk, Consumer Privacy Champion at Pixel Privacy follows with this:

“This breach underscores the concerns many privacy advocates, myself included, have about forcing websites to require users to submit images of their driver’s licenses and other personal and financial information before being allowed to access adult and other types of content. When third parties are involved, like in this case, it increases the risk to users’ information, as it increases the attack surface for breaches such as this.”

“Cybercriminals often target databases that contain personal and financial information, making info like driver’s licenses, social security numbers, credit card and banking account numbers, and other info a valuable commodity among the bad actors of the world.”

Now as far as our team is concerned, nobody on the team has submitted their personal documents to use Discord. Or more accurately, nobody has admitted to do so. IF they have, it’s likely not going to end well.

Leave a comment »

Hug Your Younger Self…. Trend Or Risk?

Posted in Commentary on October 9, 2025 by itnerd

There is a social media trend that is making the rounds called “hug your younger self.” A quick search engine search shows that there’s all sorts of websites that will generate photos of your older and younger self hugging. But all is not what it seems when it comes to these websites according to Dr. Michael Peirce, Chief Scientist of Daon, a leading provider of digital identity solutions that help businesses verify, authenticate, and secure customer identities through biometric and multi-factor authentication.

What risks are associated with uploading childhood and current photos to LLMs?

“The primary risk is the same as loading any other kind of personally identifiable information onto the Internet. You lose all control of your personal data, and how, where, and by whom it is used for all time. It’s very similar to the viral “Tell your friends about yourself by answering 40 questions” game that went around social media for years. While individuals both shared and participated in this innocently, it created a treasure trove of data for fraudsters to use to attack knowledge-based authentication. The same principle exists in this case. Once your image is available online, people with bad intentions can use it for whatever they choose. Add to that the fact that deepfake technology is at the point that a believable image or even video can be generated from a single image, and you have the makings of a significant threat. Once bad actors have a deepfake, it can be used for blackmail, reputational harm, and even to defeat lower quality biometric security.

Furthermore, depending on the terms of usage of the LLMs, photos of your face may be used to help train future LLMs and other AI algorithms. The images might even be sold to other interested parties. Your face or its similarity could even become part of images provided back to other users in response to their LLM prompts. This could include images that, through no intention of the user, closely resemble you appearing in commercial or other applications. Legal precedent for unintentional use of AI generated likeness is still being established.”

Leave a comment »

« Older Entries